Anthropic – Claude Code – Cursor – Panorays Threat Intelligence Report – Oct 2026

A trojanized version of Anthropic’s official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems.¹²

The malicious update, released as version 2.1.313 under Anthropic’s legitimate extension identifier anthropic.claude-code, contained a malicious 66-line loader prepended to the legitimate extension code.¹² Upon activation, the extension added an attacker-controlled SSH key labeled “svc-telemetry” to “~/.ssh/authorized_keys”, attempted to establish a reverse SSH tunnel to 134.209.82.225, and configured persistence through scheduled tasks, crontab, or a LaunchAgent. The extension also transmitted host reconnaissance data, including IP addresses, local usernames, hostnames, Git email configurations, and the names of up to 40 sensitive environment variables, over an unencrypted HTTP request to 134.209.82.225:8099/beacon.¹

Cursor reported that the incident affected at most 5,000 users who installed the package between about 2:27 a.m. and 1:35 p.m. PT on October 29, 2026.¹² Cursor temporarily shut down its marketplace to pull the compromised package, while Anthropic released clean version 2.1.314 to Open VSX and the Microsoft VS Code Marketplace. The unauthorized update was isolated to Cursor’s marketplace, with no evidence that it reached Open VSX or Microsoft’s official VS Code Marketplace.¹

1. Attacker claimNot reached

   A threat actor says it did this. No independent confirmation.

2. Trusted source reportedOctober 30, 2026

   A credible third party reported it: a security vendor, a mainstream outlet, or a government or CERT advisory. The company has not acknowledged it.

3. Company acknowledgedOctober 29, 2026

   The affected company itself confirmed or acknowledged it, for example in a statement or a regulatory filing.

4. Follow-upOctober 30, 2026

   Coverage after the company acknowledged it: further statements, arrests, charges, fines or lawsuits. It never raises the verification.

1. Between about 2:27 a.m. and 1:35 p.m. PT on October 29, 2026

   At most 5,000 users install compromised Claude Code extension version 2.1.313 through the Cursor Marketplace.¹²

   What the attackers didCompany acknowledged

2. October 29, 2026

   Cursor identifies the security incident and temporarily shuts down its extension marketplace to remove the malicious package.¹²

   What the company didCompany acknowledged

3. October 30, 2026

   Anthropic publishes clean Claude Code version 2.1.314 to Open VSX and the Microsoft VS Code Marketplace after the malicious package is removed.¹

   What the company didFollow-up

Attack vector

Trojanized extension update via the Cursor Marketplace

Attackers published a modified version of Claude Code (version 2.1.313) using Anthropic’s legitimate extension identifier anthropic.claude-code directly to the Cursor IDE marketplace.¹²

Attack model

Software supply chain compromise and persistent backdoor deployment

The payload introduced an unauthorized SSH key, established cross-platform persistence, initiated a reverse SSH tunnel, and harvested host reconnaissance data.¹²

Data exposed

Host reconnaissance details and environment variable names

The extension sent public IP addresses, hostnames, usernames, OS and CPU architectures, Git email addresses, and the names of up to 40 environment variables containing sensitive keywords to a remote server.¹

1. Taken October 30, 2026¹
2. Leak threatened
3. Leaked or for sale

Scale

At most 5,000 users

Cursor confirmed that the incident impacted at most 5,000 users who downloaded the extension during the distribution window on October 29, 2026.¹

Dwell time

Approximately 11 hours

The malicious package was distributed between about 2:27 a.m. and 1:35 p.m. PT on October 29, 2026 before being pulled.¹

Techniques Attacker behaviour described in the articles, mapped to MITRE ATT&CK

• Supply Chain Compromise: Compromise Software Supply ChainATT&CK IDT1195.002TacticInitial AccessMapped fromdistributing a modified extension package through a software marketplace¹²
• Software Extensions: IDE ExtensionsATT&CK IDT1176.002TacticPersistenceMapped fromexecuting malicious loader code inside an IDE extension¹²
• Account Manipulation: SSH Authorized KeysATT&CK IDT1098.004TacticPersistenceMapped fromadding an attacker-controlled key labeled svc-telemetry to ~/.ssh/authorized_keys¹
• Protocol TunnelingATT&CK IDT1572TacticCommand and ControlMapped fromestablishing a reverse SSH tunnel to a remote C2 address¹
• Scheduled Task/Job: CronATT&CK IDT1053.003TacticPersistenceMapped frominstalling persistence via crontab¹
• Scheduled Task/Job: Scheduled TaskATT&CK IDT1053.005TacticPersistenceMapped frominstalling persistence via a scheduled task¹
• Create or Modify System Process: Launch AgentATT&CK IDT1543.001TacticPersistenceMapped frominstalling persistence via LaunchAgent¹
• System Information DiscoveryATT&CK IDT1082TacticDiscoveryMapped fromcollecting OS, CPU architecture, hostname, and working directory details¹
• System Owner/User DiscoveryATT&CK IDT1033TacticDiscoveryMapped fromquerying local username and global Git user email configuration¹
• Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 ProtocolATT&CK IDT1048.003TacticExfiltrationMapped fromtransmitting beacon data over unencrypted HTTP¹

Technologies

• Cursor
• Cursor Marketplace
• Claude Code
• VS Code
• Open VSX
• SSH

Indicators Addresses, domains and files linked to the attackers. Values are defanged and not linked.

• IP address134.209.82[.]225C2 server for reverse SSH tunneling and beacon endpoint¹
• URL134.209.82[.]225:8099/beaconUnencrypted HTTP beacon URL for telemetry exfiltration¹

• M
  MicrosoftMentioned only Informational Mention

  Microsoft’s official VS Code Marketplace was confirmed not to have been reached or impacted by the malicious update.¹

• O
  OVHcloudMentioned only Informational Mention

  OVHcloud was referenced as background context regarding an earlier CLI binary replacement incident.¹

1. 1
   Official Claude Code VS Code Extension Compromised to Install Persistent SSH BackdoorThe Hacker News · October 30, 2026

   The Hacker News technical analysis detailing the trojanized Claude Code extension distributed via Cursor Marketplace.

2. 2
   Security notice: malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension MarketplaceCursor · October 29, 2026

   Official security notice from Cursor identifying the malicious package on its marketplace.